topic Re: AAA Authentication in Network Access Control

AAA Authentication

singraj2001 — Mon, 11 Mar 2019 00:04:03 GMT

Hi,

I Have ASA 5520 In My Network, Here From Inside Users Have To Access The Terminal Server Which Is Located In DMZ. If I Want To Access The Terminal Server From Inside Users It Has To Authenticate By AAA Local Database.

Re: AAA Authentication

Federico Coto Fajardo — Fri, 16 Apr 2010 03:01:20 GMT

Hi,

I believe you can do the following:

username user password pass

access-list ACL_AAA permit tcp INSIDE_NETWORK mask host DMZ_SERVER eq 3389

aaa authentication match ACL_AAA inside LOCAL

In this way, when the INSIDE_NETWORK requests to the RD server on the DMZ arrives to the inside interface of the ASA, there's an ACL that's going to match that traffic and also match the aaa authentication for the local database on the ASA.

On the ASA, the command ''sh uauth'' shows if the users are getting authenticated or not.

Federico.

Re: AAA Authentication

singraj2001 — Thu, 22 Apr 2010 09:25:41 GMT

Thanks lot Federico,

I have one more request,

I have the four inside interfaces and one DMZ interface. For each inside interface users have to access the Terminal Server authenticate by AAA using different Username and Password.

thanks once again

S.Rajkumar

Re: AAA Authentication

Federico Coto Fajardo — Thu, 22 Apr 2010 17:19:18 GMT

You can try the following:

Create a local database of users:

username user1 password pass1
username user2 password pass2
username user3 password pass3
username userx password passx

Create an object-group that groups the four inside networks and apply the object-group to the ACL:

access-list ACL_AAA permit tcp object-group INSIDE_NETWORKS mask host DMZ_SERVER eq 3389

Specify the ACL on the AAA rule:

aaa authentication match ACL_AAA inside LOCAL

Federico.

Re: AAA Authentication

singraj2001 — Fri, 23 Apr 2010 00:39:37 GMT

Thanks federico

Re: AAA Authentication

singraj2001 — Wed, 16 Jun 2010 09:09:11 GMT

Hi,

When try to configure below comments,

Create a local database of users:

username user1 password pass1
username user2 password pass2
username user3 password pass3
username userx password passx

Create an object-group that groups the four inside networks and apply the object-group to the ACL:

access-list ACL_AAA permit tcp object-group INSIDE_NETWORKS mask host DMZ_SERVER eq 3389

Specify the ACL on the AAA rule:

aaa authentication match ACL_AAA inside LOCAL

I am facing the error which I discribed below,

ASA does not support interactive authentication for the rules that are applied to traffic other than FTP, HTTP, HTTPS, Telnet and SSH.